<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    
    <title>18. PowerShell für ActiveDirectory &mdash; PowerShell fuer Systemintegratoren</title>
    
    <link rel="stylesheet" href="_static/sphinxdoc.css" type="text/css" />
    <link rel="stylesheet" href="_static/pygments.css" type="text/css" />
    
    <script type="text/javascript">
      var DOCUMENTATION_OPTIONS = {
        URL_ROOT:    './',
        VERSION:     '1.0',
        COLLAPSE_INDEX: false,
        FILE_SUFFIX: '.html',
        HAS_SOURCE:  true
      };
    </script>
    <script type="text/javascript" src="_static/jquery.js"></script>
    <script type="text/javascript" src="_static/underscore.js"></script>
    <script type="text/javascript" src="_static/doctools.js"></script>
    <script type="text/javascript" src="_static/translations.js"></script>
    <link rel="top" title="PowerShell fuer Systemintegratoren" href="index.html" />
    <link rel="next" title="19. Powershell und Datenbanken" href="powershell_datenbanken.html" />
    <link rel="prev" title="17. Anhang" href="powershell_anhang_1.html" /> 
  </head>
  <body>
    <div class="related">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="genindex.html" title="Allgemeiner Index"
             accesskey="I">Index</a></li>
        <li class="right" >
          <a href="powershell_datenbanken.html" title="19. Powershell und Datenbanken"
             accesskey="N">weiter</a> |</li>
        <li class="right" >
          <a href="powershell_anhang_1.html" title="17. Anhang"
             accesskey="P">zurück</a> |</li>
        <li><a href="index.html">PS4SYS</a> &raquo;</li> 
      </ul>
    </div>
      <div class="sphinxsidebar">
        <div class="sphinxsidebarwrapper">
            <p class="logo"><a href="index.html">
              <img class="logo" src="_static/PowerShell_icon_small.png" alt="Logo"/>
            </a></p>
  <h3><a href="index.html">Inhalt</a></h3>
  <ul>
<li><a class="reference internal" href="#">18. PowerShell für ActiveDirectory</a><ul>
<li><a class="reference internal" href="#beispiel-creativ-gmbh">18.1. Beispiel Creativ GmbH</a></li>
<li><a class="reference internal" href="#zuordnen-eines-homeverzeichnisses-pro-user">18.2. Zuordnen eines Homeverzeichnisses pro User</a></li>
<li><a class="reference internal" href="#useranlage-uber-csv-dateien-etc">18.3. Useranlage über CSV-Dateien, etc</a></li>
<li><a class="reference internal" href="#filter">18.4. Filter</a></li>
<li><a class="reference internal" href="#queries-mit-adsisearcher-oder-system-directory-directorysearcher">18.5. Queries mit [ADSISearcher] oder System.Directory.DirectorySearcher</a></li>
<li><a class="reference internal" href="#suchanfragen-in-ps">18.6. Suchanfragen in PS</a><ul>
<li><a class="reference internal" href="#suche-nach-einem-user">18.6.1. Suche nach einem User</a><ul>
<li><a class="reference internal" href="#mit-hilfe-von-ado">18.6.1.1. Mit Hilfe von ADO</a></li>
<li><a class="reference internal" href="#mit-hilfe-des-directorysearchers">18.6.1.2. Mit Hilfe des DirectorySearchers</a></li>
<li><a class="reference internal" href="#activedirectory-cmdlet">18.6.1.3. ActiveDirectory CmdLet</a></li>
<li><a class="reference internal" href="#get-aduser-cmdlet">18.6.1.4. Get-ADUser-Cmdlet</a></li>
<li><a class="reference internal" href="#weitere-beispiele">18.6.1.5. Weitere Beispiele</a></li>
</ul>
</li>
</ul>
</li>
<li><a class="reference internal" href="#url">18.7. Url</a></li>
</ul>
</li>
</ul>

  <h4>Vorheriges Thema</h4>
  <p class="topless"><a href="powershell_anhang_1.html"
                        title="vorheriges Kapitel">17. Anhang</a></p>
  <h4>Nächstes Thema</h4>
  <p class="topless"><a href="powershell_datenbanken.html"
                        title="nächstes Kapitel">19. Powershell und Datenbanken</a></p>
  <h3>Diese Seite</h3>
  <ul class="this-page-menu">
    <li><a href="_sources/powershell_activedirectory.txt"
           rel="nofollow">Quelltext anzeigen</a></li>
  </ul>
<div id="searchbox" style="display: none">
  <h3>Schnellsuche</h3>
    <form class="search" action="search.html" method="get">
      <input type="text" name="q" />
      <input type="submit" value="Los" />
      <input type="hidden" name="check_keywords" value="yes" />
      <input type="hidden" name="area" value="default" />
    </form>
    <p class="searchtip" style="font-size: 90%">
    Geben Sie Suchbegriffe oder einen Modul-, Klassen- oder Funktionsnamen ein.
    </p>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
        </div>
      </div>

    <div class="document">
      <div class="documentwrapper">
        <div class="bodywrapper">
          <div class="body">
            
  <div class="section" id="powershell-fur-activedirectory">
<h1>18. PowerShell für ActiveDirectory<a class="headerlink" href="#powershell-fur-activedirectory" title="Permalink zu dieser Überschrift">¶</a></h1>
<div class="section" id="beispiel-creativ-gmbh">
<h2>18.1. Beispiel Creativ GmbH<a class="headerlink" href="#beispiel-creativ-gmbh" title="Permalink zu dieser Überschrift">¶</a></h2>
<p>Im folgenden Beispiel wird für eine beispielhafte Firma Creativ GmbH der Aufbau eines ActiveDirectory dargestellt.</p>
<img alt="_images/adcreativ.png" src="_images/adcreativ.png" />
<img alt="_images/ad_groups.png" src="_images/ad_groups.png" />
<p>Innerhalb der Domäne steinam.test werden folgende Aktionen durchgeführt</p>
<ul class="simple">
<li>OU Creative</li>
<li>OU Auftragsbearbeitung</li>
<li>OU Geschaeftsleitung</li>
<li>OU ServiceUndSupport</li>
<li><ul class="first">
<li>Multimedia</li>
</ul>
</li>
<li><ul class="first">
<li>Training</li>
</ul>
</li>
<li>SoftwareUndTrainig</li>
<li>OU Groups</li>
<li>mehrere globale Gruppen</li>
<li>User</li>
<li>Anlegen von mehreren Usern in der OU Geschaeftsleitung</li>
<li>Zuweisen der User zu diversen Gruppen</li>
</ul>
<div class="highlight-sh"><pre>Import-Module ActiveDirectory

$OUListe = @("Geschaeftsleitung", "Auftragsbearbeitung", "ServiceUndSupport", "SoftwareUndTraining")
$Domain = [ADSI]""


#Erzeugen der OUs
$Company = $Domain.create("organizationalUnit", "OU=Creative")
$Company.setInfo()

foreach($element in $OUListe)
{
        $OU = $Company.create("organizationalUnit", "OU=" + $element)
        $OU.setInfo()
}

$UnterOUListe = @("MultiMedia", "Training")

#Referenz auf ServiceUndSupport-OU holen
#Wäre auch mit Variable $company möglich gewesen, da diese auf Creative verweist
$ldap = "OU=ServiceUndSupport, OU=Creative"
$dn = $Domain.distinguishedName
$SuS = [ADSI]"LDAP://$ldap, $dn"

#Iteration durch Arry mit Unter-OUs
foreach($element in $UnterOUListe)
{
        $UnterOU = $SuS.create("organizationalUnit", "OU=" + $element)
        $UnterOU.setInfo()
}



#Anlegen einer Gruppe
#1. Anlegen einer OU
#2. Referenz auf OU holen bzw. nutzen
#3. In OU mit Hilfe von Create("group", "CN=Gruppenname") die Gruppe anlegen
#4. und Referenz auf Gruppe in Variable halten
#5. Über die Variable den Gruppentyp festlegen
#6. Gruppe mit Hilfe von SetInfo() in das AD schreiben


#Liste mit anzulegenden Gruppen
$grpListe = @("Creativ.G", "Geschaeftsleitung.G", "Management.G", "Personal.G","Software.G","Support.G", "Training.G")

#1
$GruppenOU = $Domain.create("organizationalUnit", "OU=Groups")
$GruppenOU.setInfo()
foreach($element in $grpListe)
{
        $gruppe = $GruppenOU.create("group",  "CN=" + $element)
        #globale Gruppe anlegen
        $gruppe.psbase.InvokeSet("groupType", 2)
        $gruppe.SetInfo()
}



#Referenz auf OU Geschaeftsleitung holen
$OU_GL = "OU=Geschaeftsleitung, OU=Creative"
$dn = $Domain.distinguishedName

$GL = [ADSI]"LDAP://$OU_GL, $dn"

#diee Vorgehensweise erzeugt in Win2008 die "preliminary Win2000-User-Version"
$user = $GL.Create("User", "CN=Mahn")
$user.SetInfo()
$user.Description = "Wolfgang Mahn"
$user.SetPassword("TopSecret99")

$user.Put(“sAMAccountName”,"mahn")
$user.psbase.InvokeSet('AccountDisabled', $false)
$user.SetInfo()

#so legt man einen User mit den AD-Commandlets von PS an
New-ADUser –sAMAccountName „Yusuf“ –UserPrincipalName Yusuf@ad.dikmenoglu.de –givenname “Yusuf” –Surname “Dikmenoglu” –displayName “Yusuf Dikmenoglu” –Name “Yusuf Dikmenoglu” –scriptpath “login.bat” –Enabled $true –Path "OU=Geschaeftsleitung, OU=Creative,DC=steinam,DC=test” –AccountPassword (ConvertTo-Securestring “Pa$$w0rd!” –asplaintext –Force)


#User steinam der Gruppe Creativ.G hinzufügen

$Ou_creativ = "CN=Creativ.G, OU=Groups, DC=steinam, DC=test"
$creativgruppe = [ADSI]"LDAP://$Ou_creativ"
$creativgruppe.member.add("CN=Mahn,OU=Geschaeftsleitung,OU=Creative,DC=steinam,DC=test")
$creativgruppe.setinfo()</pre>
</div>
</div>
<div class="section" id="zuordnen-eines-homeverzeichnisses-pro-user">
<h2>18.2. Zuordnen eines Homeverzeichnisses pro User<a class="headerlink" href="#zuordnen-eines-homeverzeichnisses-pro-user" title="Permalink zu dieser Überschrift">¶</a></h2>
<p>Siehe dazu: <a class="reference external" href="http://www.powershell.nu/2009/04/27/part-116-adding-homefolder-through-powershell/">http://www.powershell.nu/2009/04/27/part-116-adding-homefolder-through-powershell/</a></p>
<p>Das Anlegen eines Homeverzeichnisses für einen User kann in folgenden Schritten erfolgen:</p>
<blockquote>
<div><ul class="simple">
<li>Anlegen einer Freigabe auf dem Server</li>
<li>Anlegen eines Ordners für jeden User innerhalb der Freigabe</li>
<li>Angemessene Rechtevergabe für den jeweiligen Ordner</li>
<li>Zuweisen des Homeverzeichnisses im jeweiligen User-Objekt des AD</li>
</ul>
</div></blockquote>
<p>See <a class="reference download internal" href="_downloads/Add-STShare.ps1"><tt class="xref download docutils literal"><span class="pre">Add-STShare.ps1</span></tt></a>.</p>
<p><abbr title="last-in, first-out">LIFO</abbr></p>
<p><em class="menuselection">Start ‣ Programs</em></p>
</div>
<div class="section" id="useranlage-uber-csv-dateien-etc">
<h2>18.3. Useranlage über CSV-Dateien, etc<a class="headerlink" href="#useranlage-uber-csv-dateien-etc" title="Permalink zu dieser Überschrift">¶</a></h2>
<p>In größeren Systemen werden User nicht einzeln angelegt; die Informationen gelangen aus Datenbanken bzw. Textdateien in das AD.</p>
<p>Im folgenden Beispiel wird eine csv-Datei genommen, um die notwendigen Informationen zur Useranlage zu erhalten.</p>
<div class="highlight-sh"><div class="highlight"><pre>     Aufbau der csv-Datei

     Name    , Login, Passwort, Gruppe, OU
     STE, steinam, P@sswOrt, Creativ.G, Geschaeftsleitung
     SIE, sierl, sIeRl, Support.G, SoftwareUndService
WAL, wallner, w@llNer, Management.G , Auftragsbearbeitung
     .....
</pre></div>
</div>
</div>
<div class="section" id="filter">
<h2>18.4. Filter<a class="headerlink" href="#filter" title="Permalink zu dieser Überschrift">¶</a></h2>
<p>Beispiel 1: Auflisten aller Objekte einer OU (ohne Rekursion)</p>
<div class="highlight-sh"><div class="highlight"><pre><span class="nv">$OU</span><span class="o">=([</span>adsi<span class="o">]</span><span class="s2">&quot;LDAP://ou=User,ou=scripting,dc=dom1,dc=intern&quot;</span><span class="o">)</span>
<span class="nv">$ou</span>.children | foreach <span class="o">{</span><span class="nv">$_</span>.name<span class="o">}</span>
</pre></div>
</div>
<p>Beispiel 2: Suchen ab einem Eintiegspunkt nach einem Namensbestandteil (mit Rekursion)</p>
<div class="highlight-sh"><div class="highlight"><pre>    <span class="c">#DN der Domaäne und PDCe bestimmen</span>
    <span class="k">function </span>getRootDSEandPDCe <span class="o">{</span>
    <span class="nv">$rootDSE</span> <span class="o">=</span> <span class="o">[</span>ADSI<span class="o">]</span><span class="s2">&quot;LDAP://rootDSE&quot;</span>
            <span class="nv">$fndomainDN</span> <span class="o">=</span> <span class="nv">$rootDSE</span>.defaultNamingContext
            <span class="nv">$fndomainDN</span>  <span class="c">#erstes Suchergebnis</span>

            <span class="nv">$domain</span><span class="o">=[</span>System.DirectoryServices.ActiveDirectory.Domain<span class="o">]</span>::getcurrentdomain<span class="o">()</span>
            <span class="nv">$fnPDCe</span><span class="o">=</span><span class="nv">$domain</span>.PdcRoleOwner.Name
            <span class="nv">$fnPDCe</span>
    <span class="o">}</span>

    <span class="c">#Rekursiv die Domäne durchsuchen. Einstiegspunkt der Suche ist fnEntry z.B. DC=Dom1,DC=Intern</span>
    <span class="k">function </span>findEntriesInSubOUs<span class="o">(</span><span class="nv">$fnEntry</span><span class="o">){</span>
            <span class="nv">$AD</span><span class="o">=[</span>ADSI<span class="o">]</span><span class="s2">&quot;LDAP://$fnEntry&quot;</span> <span class="c">#andere Schreibweisen im Beispiel von Kap. 2.1</span>
     <span class="k">if</span><span class="o">(</span><span class="nv">$fnentry</span> -like <span class="s2">&quot;*$SearchObject*&quot;</span><span class="o">){</span>
       <span class="nv">$fnEntry</span>   <span class="c">#die Suchergebnisse werden als Array gespeichert</span>
     <span class="o">}</span>
     <span class="nv">$AD</span>.children | foreach <span class="o">{</span>  <span class="c">#Rekursion</span>
     findEntriesInSubOUs<span class="o">(</span><span class="nv">$_</span>.distinguishedname<span class="o">)}</span>
<span class="o">}</span>

    <span class="nv">$ergebnis</span><span class="o">=</span>getRootDSEandPDCe
    <span class="nv">$DomainDN</span><span class="o">=</span><span class="nv">$ergebnis</span><span class="o">[</span>0<span class="o">]</span>
    <span class="nv">$PDCe</span><span class="o">=</span><span class="nv">$ergebnis</span><span class="o">[</span>1<span class="o">]</span>

    write-host -foregroundcolor blue  <span class="s2">&quot;DN der Domäne: $DomainDN&quot;</span>
    write-host -foregroundcolor darkyellow <span class="s2">&quot;PDCEmulator:   $PDCe&quot;</span>
    <span class="c">#weitere Farben unter &quot;get-help write-host&quot; -&gt; Syntax</span>
    <span class="s2">&quot;&quot;</span>
    <span class="nv">$Searchobject</span><span class="o">=</span><span class="s2">&quot;test&quot;</span>
    <span class="nv">$SearchErgebnis</span><span class="o">=</span>findEntriesInSubOUs<span class="o">(</span><span class="nv">$domaindn</span><span class="o">)</span> <span class="c">#domaindn ist der Startpunkt der Suche</span>
    <span class="nv">$SearchErgebnis</span> | foreach <span class="o">{</span>write-host -foregroundcolor red <span class="nv">$_</span><span class="o">}</span>

    <span class="c">#Ausgabe</span>

    DN der Domäne: <span class="nv">DC</span><span class="o">=</span>Dom1,DC<span class="o">=</span>intern
    PDCEmulator:   DC1.Dom1.intern

    <span class="nv">CN</span><span class="o">=</span>Share-Test1,OU<span class="o">=</span>scripting,DC<span class="o">=</span>Dom1,DC<span class="o">=</span>intern
    <span class="nv">CN</span><span class="o">=</span><span class="nb">test</span>-2,OU<span class="o">=</span>scripting,DC<span class="o">=</span>Dom1,DC<span class="o">=</span>intern
    <span class="nv">CN</span><span class="o">=</span><span class="nb">test</span>-leer,OU<span class="o">=</span>scripting,DC<span class="o">=</span>Dom1,DC<span class="o">=</span>intern
</pre></div>
</div>
</div>
<div class="section" id="queries-mit-adsisearcher-oder-system-directory-directorysearcher">
<h2>18.5. Queries mit [ADSISearcher] oder System.Directory.DirectorySearcher<a class="headerlink" href="#queries-mit-adsisearcher-oder-system-directory-directorysearcher" title="Permalink zu dieser Überschrift">¶</a></h2>
<p>[ADSISearcher] oder gleichbedeutend &#8221; System.Directoryservices.Directorysearcher&#8221; bietet eine Vielzahl an Methoden und Eigenschaften an, um LDAP-Queries ganz genau auf seine Anforderungen hinzu designen. Allerdings erfordert die durch diese Vielzahl erreichte Flexibilität sowohl ein gewisses Maß an Verständnis der Materie wie auch sorgfätige Tests.</p>
<p>Beispiel 1: vier verschiedene Syntaxvarianten für die .Net-Klasse System.Directoryservices.Directorysearcher</p>
<div class="highlight-sh"><div class="highlight"><pre><span class="o">([</span>ADSISearcher<span class="o">]</span><span class="s2">&quot;(|(Name=*Test*)(Name=*Napf*))&quot;</span><span class="o">)</span>.findall<span class="o">()</span> | <span class="k">select </span>path

<span class="o">([</span>system.directoryservices.directorysearcher<span class="o">]</span><span class="s2">&quot;(|(Name=*Test*)(Name=*napf*))&quot;</span><span class="o">)</span>.findall<span class="o">()</span> | <span class="k">select </span>path

<span class="nv">$ds</span><span class="o">=</span>new-object -typename system.directoryservices.directorysearcher
<span class="nv">$ds</span>.filter<span class="o">=</span><span class="s2">&quot;(|(Name=*Test*)(Name=*Napf*))&quot;</span>
<span class="nv">$ds</span>.findall<span class="o">()</span>  | <span class="k">select </span>path

<span class="nv">$ds</span><span class="o">=([</span>ADSISearcher<span class="o">]</span><span class="s2">&quot;LDAP://&quot;</span><span class="o">)</span>  <span class="c">#meine favorisierte Schreibweise</span>
<span class="nv">$ds</span>.filter<span class="o">=</span><span class="s2">&quot;(|(Name=*Test*)(Name=*napf*))&quot;</span>
<span class="nv">$ds</span>.findall<span class="o">()</span>  | <span class="k">select </span>path



<span class="c"># Ausgabe, wenn Objekte vorhanden sind, deren Name &quot;Napf&quot; oder &quot;Test&quot; enthält</span>
<span class="c">#die Ausgabe erscheint viermal identisch</span>

Path
----
LDAP://CN<span class="o">=</span>Napf,CN<span class="o">=</span>Users,DC<span class="o">=</span>Dom1,DC<span class="o">=</span>intern
LDAP://CN<span class="o">=</span><span class="nb">test</span>-leer,OU<span class="o">=</span>scripting,DC<span class="o">=</span>Dom1,DC<span class="o">=</span>intern
LDAP://CN<span class="o">=</span><span class="nb">test</span>-2,OU<span class="o">=</span>scripting,DC<span class="o">=</span>Dom1,DC<span class="o">=</span>intern
LDAP://CN<span class="o">=</span>Share-Test1,OU<span class="o">=</span>scripting,DC<span class="o">=</span>Dom1,DC<span class="o">=</span>intern
</pre></div>
</div>
</div>
<div class="section" id="suchanfragen-in-ps">
<h2>18.6. Suchanfragen in PS<a class="headerlink" href="#suchanfragen-in-ps" title="Permalink zu dieser Überschrift">¶</a></h2>
<p>PS kann über verschiedene Wege Suchanfragen an einen AD-Server stellen. Die folgenden Beispiele stellen einige Szenarien sowie deren unterschiedliche Lösungsansätze dar.</p>
<div class="section" id="suche-nach-einem-user">
<h3>18.6.1. Suche nach einem User<a class="headerlink" href="#suche-nach-einem-user" title="Permalink zu dieser Überschrift">¶</a></h3>
<div class="section" id="mit-hilfe-von-ado">
<h4>18.6.1.1. Mit Hilfe von ADO<a class="headerlink" href="#mit-hilfe-von-ado" title="Permalink zu dieser Überschrift">¶</a></h4>
<p>The first example uses ADO in a PowerShell script. The steps are very similar to those that would be used in a VBScript program. We create ADO connection and command objects, assign properties like Page Size and Timeout, then assign an LDAP query with the same four clauses used in a VBScript program. The first clause specifies the &#8220;base&#8221; of the query, the second clause is an LDAP filter, the third clause is a comma delimited list of attributes, and the fourth clause specifies the scope. This script will work in PowerShell v1 or v2.</p>
<div class="highlight-sh"><div class="highlight"><pre><span class="c"># FindUser1.ps1</span>
<span class="c"># Specify Common Name of user.</span>
<span class="nv">$strName</span> <span class="o">=</span> <span class="s2">&quot;James K. Smith&quot;</span>

<span class="nv">$strDomain</span> <span class="o">=</span> <span class="o">[</span>System.DirectoryServices.ActiveDirectory.Domain<span class="o">]</span>::GetCurrentDomain<span class="o">()</span>
<span class="nv">$strRoot</span> <span class="o">=</span> <span class="nv">$strDomain</span>.GetDirectoryEntry<span class="o">()</span>

<span class="nv">$adoConnection</span> <span class="o">=</span> New-Object -comObject <span class="s2">&quot;ADODB.Connection&quot;</span>
<span class="nv">$adoCommand</span> <span class="o">=</span> New-Object -comObject <span class="s2">&quot;ADODB.Command&quot;</span>
<span class="nv">$adoConnection</span>.Open<span class="o">(</span><span class="s2">&quot;Provider=ADsDSOObject;&quot;</span><span class="o">)</span>
<span class="nv">$adoCommand</span>.ActiveConnection <span class="o">=</span> <span class="nv">$adoConnection</span>
<span class="nv">$adoCommand</span>.Properties.Item<span class="o">(</span><span class="s2">&quot;Page Size&quot;</span><span class="o">)</span> <span class="o">=</span> 100
<span class="nv">$adoCommand</span>.Properties.Item<span class="o">(</span><span class="s2">&quot;Timeout&quot;</span><span class="o">)</span> <span class="o">=</span> 30
<span class="nv">$adoCommand</span>.Properties.Item<span class="o">(</span><span class="s2">&quot;Cache Results&quot;</span><span class="o">)</span> <span class="o">=</span> <span class="nv">$False</span>

<span class="nv">$strBase</span> <span class="o">=</span> <span class="nv">$strRoot</span>.distinguishedName
<span class="nv">$strAttributes</span> <span class="o">=</span> <span class="s2">&quot;distinguishedName&quot;</span>
<span class="nv">$strScope</span> <span class="o">=</span> <span class="s2">&quot;subtree&quot;</span>

<span class="nv">$strFilter</span> <span class="o">=</span> <span class="s2">&quot;(cn=$strName)&quot;</span>
<span class="nv">$strQuery</span> <span class="o">=</span> <span class="s2">&quot;&lt;LDAP://$strBase&gt;;$strFilter;$strAttributes;$strScope&quot;</span>
<span class="nv">$adoCommand</span>.CommandText <span class="o">=</span> <span class="nv">$strQuery</span>
<span class="nv">$adoRecordset</span> <span class="o">=</span> <span class="nv">$adoCommand</span>.Execute<span class="o">()</span>

Do
<span class="o">{</span>
        <span class="nv">$adoRecordset</span>.Fields.Item<span class="o">(</span><span class="s2">&quot;distinguishedName&quot;</span><span class="o">)</span> | Select-Object Value
        <span class="nv">$adoRecordset</span>.MoveNext<span class="o">()</span>
<span class="o">}</span> Until <span class="o">(</span><span class="nv">$adoRecordset</span>.EOF<span class="o">)</span>

<span class="nv">$adoRecordset</span>.Close<span class="o">()</span>
<span class="nv">$adoConnection</span>.Close<span class="o">()</span>
</pre></div>
</div>
</div>
<div class="section" id="mit-hilfe-des-directorysearchers">
<h4>18.6.1.2. Mit Hilfe des DirectorySearchers<a class="headerlink" href="#mit-hilfe-des-directorysearchers" title="Permalink zu dieser Überschrift">¶</a></h4>
<p>The next program uses the System.DirectoryServices.DirectorySearcher class to query Active Directory. We still are able to specify Page Size, the base of the query, and the LDAP filter. We use the PropertiesToLoad property to specify the attributes values to be retrieved. If we don&#8217;t use this property, PowerShell will retrieve all attribute values, which will slow the program. This script will work in PowerShell v1 or v2.</p>
<div class="highlight-sh"><div class="highlight"><pre><span class="c"># FindUser2.ps1</span>
<span class="c"># PowerShell script to query AD for user with specified Common Name.</span>
<span class="c">#</span>
<span class="c"># ----------------------------------------------------------------------</span>
<span class="c"># Copyright (c) 2011 Richard L. Mueller</span>
<span class="c"># Hilltop Lab web site - http://www.rlmueller.net</span>
<span class="c"># Version 1.0 - January 9, 2011</span>
<span class="c">#</span>
<span class="c"># This program demonstrates how to use the</span>
<span class="c"># System.DirectoryServices.DirectorySearcher class to query Active</span>
<span class="c"># Directory. This example finds the Distinguished Name of all objects</span>
<span class="c"># (there could be more than one) that have a specified Common Name.</span>
<span class="c">#</span>
<span class="c"># Specify Common Name of user.</span>
<span class="nv">$strName</span> <span class="o">=</span> <span class="s2">&quot;James K. Smith&quot;</span>

<span class="nv">$strDomain</span> <span class="o">=</span> New-Object System.DirectoryServices.DirectoryEntry
<span class="nv">$objSearcher</span> <span class="o">=</span> New-Object System.DirectoryServices.DirectorySearcher
<span class="nv">$objSearcher</span>.SearchRoot <span class="o">=</span> <span class="nv">$strDomain</span>
<span class="nv">$objSearcher</span>.PageSize <span class="o">=</span> 100
<span class="nv">$objSearcher</span>.SearchScope <span class="o">=</span> <span class="s2">&quot;subtree&quot;</span>

<span class="c"># Specify attribute values to retrieve.</span>
<span class="nv">$arrAttributes</span> <span class="o">=</span> @<span class="o">(</span><span class="s2">&quot;distinguishedName&quot;</span><span class="o">)</span>
ForEach<span class="o">(</span><span class="nv">$strAttribute</span> In <span class="nv">$arrAttributes</span><span class="o">)</span>
<span class="o">{</span>
        <span class="nv">$objSearcher</span>.PropertiesToLoad.Add<span class="o">(</span><span class="nv">$strAttribute</span><span class="o">)</span> &gt; <span class="nv">$Null</span>
<span class="o">}</span>

<span class="c"># Filter on object with specified Common Name.</span>
<span class="nv">$objSearcher</span>.Filter <span class="o">=</span> <span class="s2">&quot;(cn=$strName)&quot;</span>

<span class="nv">$colResults</span> <span class="o">=</span> <span class="nv">$objSearcher</span>.FindAll<span class="o">()</span>
ForEach <span class="o">(</span><span class="nv">$strResult</span> In <span class="nv">$colResults</span><span class="o">)</span>
<span class="o">{</span>
        <span class="nv">$strDN</span> <span class="o">=</span> <span class="nv">$strResult</span>.Properties.Item<span class="o">(</span><span class="s2">&quot;distinguishedName&quot;</span><span class="o">)</span>
        Write-Host <span class="nv">$strDN</span>
<span class="o">}</span>
</pre></div>
</div>
</div>
<div class="section" id="activedirectory-cmdlet">
<h4>18.6.1.3. ActiveDirectory CmdLet<a class="headerlink" href="#activedirectory-cmdlet" title="Permalink zu dieser Überschrift">¶</a></h4>
<p>Finally we have a PowerShell script that uses the new Active Directory cmdlets in PowerShell v2 installed with Windows Server 2008 R2. This example uses the Get-ADObject cmdlet. We use the LDAPFilter parameter to specify our LDAP filter. This script requires PowerShell v2.</p>
<div class="highlight-sh"><div class="highlight"><pre><span class="c"># FindUser3.ps1</span>
<span class="c"># This program demonstrates how to use the Active Directory cmdlet</span>
<span class="c"># Get-ADObject to query Active Directory. This example finds the</span>
<span class="c"># Distinguished Name of all objects (there could be more than one) that</span>
<span class="c"># have a specified Common Name.</span>
<span class="c">#</span>
<span class="c"># Specify Common Name of user.</span>

<span class="nv">$strName</span> <span class="o">=</span> <span class="s2">&quot;James K. Smith&quot;</span>

Get-ADObject -LDAPFilter <span class="s2">&quot;(cn=$strName)&quot;</span> -Properties distinguishedName | Format-Table distinguishedName
</pre></div>
</div>
</div>
<div class="section" id="get-aduser-cmdlet">
<h4>18.6.1.4. Get-ADUser-Cmdlet<a class="headerlink" href="#get-aduser-cmdlet" title="Permalink zu dieser Überschrift">¶</a></h4>
<div class="highlight-sh"><div class="highlight"><pre>Import-module ActiveDirectory

<span class="c">#To query for user accounts, use the Get-ADUser cmdlet. For example, here is #how you would query against your domain for all user accounts:</span>

Get-ADUser -Filter * -SearchBase <span class="s2">&quot;DC=ad,DC=company,DC=com&quot;</span>

<span class="c">#If you wanted to query for all of the user accounts with the last name #“Collicott”, you would run the following:</span>

Get-ADUser -Filter <span class="o">{</span>Surname -eq <span class="s2">&quot;Collicott&quot;</span><span class="o">}</span> -SearchBase <span class="s2">&quot;DC=ad,DC=company,DC=com&quot;</span>

<span class="c">#To export the e-mail addresses for all user accounts to a CSV file, you #could run the following:</span>
Get-ADUser -Filter * -SearchBase <span class="s2">&quot;DC=ad,DC=company,DC=com&quot;</span> -Properties mail | Select mail | Export-CSV <span class="s2">&quot;Email Addresses.csv&quot;</span>

<span class="c">#You can also find additional examples by viewing the help on the cmdlet:</span>
Get-Help Get-ADUser -examples
</pre></div>
</div>
</div>
<div class="section" id="weitere-beispiele">
<h4>18.6.1.5. Weitere Beispiele<a class="headerlink" href="#weitere-beispiele" title="Permalink zu dieser Überschrift">¶</a></h4>
<p><a class="reference external" href="http://blog.dikmenoglu.de/CategoryView,category,Active%2BDirectory,AD-Powershell.aspx">http://blog.dikmenoglu.de/CategoryView,category,Active%2BDirectory,AD-Powershell.aspx</a></p>
<p><a class="reference external" href="http://technet.microsoft.com/en-us/library/ff730967.aspx">http://technet.microsoft.com/en-us/library/ff730967.aspx</a> (Searching Active Directory with Windows PowerShell)</p>
<p><a class="reference download internal" href="_downloads/Searching_AD_with_PS.pdf"><tt class="xref download docutils literal"><span class="pre">Searching_AD_with_PS.pdf</span></tt></a></p>
</div>
</div>
</div>
<div class="section" id="url">
<h2>18.7. Url<a class="headerlink" href="#url" title="Permalink zu dieser Überschrift">¶</a></h2>
<p>RSAT Tools für Win7: <a class="reference external" href="http://www.microsoft.com/en-us/download/details.aspx?id=7887">http://www.microsoft.com/en-us/download/details.aspx?id=7887</a></p>
<p>Eigenschaften aller AD-Klassen: <a class="reference external" href="http://msdn.microsoft.com/en-us/library/ms680987%28v=VS.85%29.aspx">http://msdn.microsoft.com/en-us/library/ms680987%28v=VS.85%29.aspx</a> <a class="reference external" href="http://technet.microsoft.com/en-us/library/cc755809%28WS.10%29.aspx">http://technet.microsoft.com/en-us/library/cc755809%28WS.10%29.aspx</a> <a class="reference external" href="http://technet.microsoft.com/en-us/library/cc780455%28v=ws.10%29.aspx">http://technet.microsoft.com/en-us/library/cc780455%28v=ws.10%29.aspx</a> <a class="reference external" href="http://technet.microsoft.com/en-us/library/cc759550%28v=ws.10%29.aspx">http://technet.microsoft.com/en-us/library/cc759550%28v=ws.10%29.aspx</a></p>
</div>
</div>


          </div>
        </div>
      </div>
      <div class="clearer"></div>
    </div>
    <div class="related">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="genindex.html" title="Allgemeiner Index"
             >Index</a></li>
        <li class="right" >
          <a href="powershell_datenbanken.html" title="19. Powershell und Datenbanken"
             >weiter</a> |</li>
        <li class="right" >
          <a href="powershell_anhang_1.html" title="17. Anhang"
             >zurück</a> |</li>
        <li><a href="index.html">PS4SYS</a> &raquo;</li> 
      </ul>
    </div>
    <div class="footer">
        &copy; Copyright 2010, STE.
      Mit <a href="http://sphinx-doc.org/">Sphinx</a> 1.2b1 erstellt.
    </div>
  </body>
</html>